Suspicious 85% chrome Download

gkhgmcdfdkamldnplbimannglblbaiaa

Instagram credential harvesting extension

HTTP POST claims form encoding but sends base64 bodyActiveXObject string presence
SHA-2560524e1bee589dc9038bcad182546aebb820c038c7cc4e03a944476bff4c264e2
URLhttps://clients2.google.com/service/update2/crx?response=redirect&prodversion=131.0&acceptformat=crx3&x=id%3Dgkhgmcdfdkamldnplbimannglblbaiaa%26installsource%3Dondemand%26uc
MaleculeO₇(ErAs₂C₄CaLaSXe₂)H₇(Cm₁₀Db₅F₂Os₄Po₂U)Md₇(BkInLi₂Pa)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.